PDPA 2012 PRIVACY POLICY

PUBLISHED September 01, 2019

What is a Privacy Policy?

In order for Tower Transit to achieve our vision of being the best and most respected provider of Singapore bus services we value the importance of appropriately processing personal data and keeping data secure. In our operations, we process personal data about our passengers, visitors to our website, members of the public and our suppliers.

This Privacy Policy sets out important information about our data processing activities. We encourage you to take the time to read the contents of this Privacy Policy so you can better understand what personal data we process, why we process it, what happens to your personal data and what rights you have in relation to your personal data. It applies to the processing of personal data in relation to services provided by Tower Transit which includes the operation of the Tower Transit website: https://www.towertransit.sg/

When we refer to “Tower Transit”, “us”, “we” or “our” what we really mean is Tower Transit Singapore , a company registered office at 21 Bulim Drive, Bulim Bus Depot, Singapore 648170 Registration number 201419417K . Tower Transit is a Controller of your personal data. You can contact us by emailing PDPA@towertransit.sg

What personal data does Tower Transit collect?

When we refer to “personal data” we mean information about an individual from which that person can be identified, this does not include anonymous data where identifying information has been removed.

Types of personal data we collect

We process different types of personal data depending on who you are.

I am…

We collect your personal data…

A passenger

When you use one of our buses:

We collect CCTV images of you on and around our buses and at our depots (CCTV Data)

We may incidentally collect audio recordings of you from a microphone placed in the drivers cab (Audio Data)

We collect your contact details (including your full name and address) if you have left personal belongings on one of our buses, or if you have found someone else’s personal belongings on one of our buses (Lost Property Data).

If you are involved in an accident involving one of our buses we collect your contact details (including your full name, telephone number, address, vehicle details, age and email address) and we collect details of the accident (including [the time and date of the accident and the circumstances of the accident]) (Accident Data)

If you have a complaint about how our buses are operated, we collect your full name, email address and telephone number (Complaint Data)

We may collect special categories of personal data about you if you are involved in an accident involving one of our buses or if you make a complaint to us. This may include data relating to your health, medical conditions or disability (Special Data)

A member ofthe public

If you:

Witness an accident involving one of our buses we collect Accident Data from you

Have a complaint about how our buses are operated, we collect ComplaintData.

Claim lost property on someone’s behalf, we collect your name and address (Claimant Data).

Phone us or our control room, we may monitor and record your call (Telephone Data)

Visit one of our depots we collect CCTVData

A visitor to
our website

When you visit our website, we process information about how you use our website, for example we process personal data about your internet browser, operating device and application identifiers, IP address and geo-location information, access times and dates, referring and exit pages, URLs, clickstream data, search items, pages viewed and time spent on pages (Website Data)

A third party supplier

If you:

Work for one of our third party suppliers, or if you work with us to help us provide our services, we process personal data about you and colleagues that we work with in order to help us facilitate the provision of services. This includes your full name, email address, contact telephone number and job title (Supplier Data)

Are on and around our buses and at our depots we collect CCTV Data

Where we get your personal data from

We collect information about you from different sources, including:

From you directly:

when you correspond with us by post, phone, email or otherwise;

when you complete one of our lost property forms or accident forms; and

when you use our website.

From a third party:-

from LTA, if you make a complaint to them about how our buses are operated or if you contact them about lost property left on one of our buses; and

from someone else, if you have left personal belongings on one of our buses and someone hands it in to us.

We try to be sure that the personal data we hold about you is accurate, and so please get in touch with us if your personal data changes so we can update our records. You can contact us using the details provided in this Privacy Policy.

Children

Our website is not intended for use by children, and we do not knowingly process personal data through our website that relates to children.

As a public transportation operator, we do process children’s personal data from time to time. For example, if they are a passenger on one of our buses they may appear on CCTV footage, or if they are involved in an incident we may collect personal data about them in order to investigate the incident appropriately.

CCTV

We operate CCTV cameras in all of our buses and in our depots, and we operate intermittent audio recording in and around our drivers’ cab area.

We use the footage and audio captured to ensure the safety of all drivers, passengers and members of the public, to investigate collisions and incidents involving our buses, to prevent, detect or investigate crime, and to assist with the apprehension and prosecution of offenders.

We can retrieve footage for up to 28 working from the date of the incident, whichever is sooner. After this time, the footage is recorded over unless we need to retain it for investigations.

There may be circumstances where we disclose footage captured by our CCTV cameras and audio recording device. This includes where statutory provisions or a court order imposes a mandatory duty to disclose, or where statutory provisions impose upon us discretion as to whether to disclose the footage. A member of senior management considers disclosure requests on a case by case basis.

Ticketing

When you pay to use one of our buses you “tap in” to a LTA operated payment system. This system provides us with a report that tells us that a payment has been made at a particular time by a particular payment method (i.e. travelcard, credit/debit card or a bus pass).

We do not have control over the personal data processed by this payment system and we do not collect personal data from it.

Why does Tower Transit need to process my personal data?

There are a number of reasons why we process your personal data. We have summarised the reasons within the table below.

Purpose

Types of Data

Lawful Basis for Processing

To comply with our obligations as an operator of public transport services

CCTV Data, Audio Data, Complaint Data and Accident Data

Necessary for our legitimate interests (to operate a public transportation service, to ensure the safety and security of our passengers, for running our business)

To ensure the safety of passengers, drivers and members of the public

CCTV Data and Audio Data

Necessary for our legitimate interests (to ensure the safety and security of our passengers and drivers and members of the public, to prevent and detect crime, to assist with investigating complaints and for the apprehension and prosecution of offenders)

Necessary to comply with our legal obligations

To collect, store and return personal belongings left on our buses

Lost Property Data, Telephone Data and Claimant Data

Necessary for our legitimate interests (for customer services, to operate a public transportation service, to restore lost property to individuals, and for administrative purposes)

To record, manage and resolve complaints

Complaint Data, Telephone Data and Special Data

Necessary for our legitimate interests (to ensure the safety and security of our passengers, drivers and members of the public, for insurance purposes, to operate a public transportation service and for administrative purposes)

In terms of Special Data, it is additionally processed:

– with your explicit consent;

– to protect your interests (or someone else’s interests) if you are not capable of giving consent;

– where you have already made the information public; or

– in connection with legal claims.

To record and manage accidents on or involving our buses

Accident Data and Special Data

Necessary for our legitimate interests [(to appropriately deal with complaints, for insurance purposes, to operate a public transportation service and for administrative purposes)]

Necessary to comply with our legal obligations

In terms of Special Data, it is additionally processed:

– with your explicit consent;

– to protect your interests (or someone else’s interests) if you are not capable of giving consent;

– where you have already made the information public; or

– in connection with legal claims.

To administer and protect our business and our website (for example, to facilitate the provision of our services, for troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

Website Data and Supplier Data

Necessary for our legitimate interests (to operate a public transportation service, provision of administration and IT services, network security and in the context of a business reorganisation or group restructuring exercise)

We may process your personal data for a different purpose than that listed above and without your consent where it is necessary for us to comply with our legal obligations.

If you would like further information about the specific legal basis for our processing of your personal data, please get in touch with us.

Our Website and Cookies

Our website may include links to third party websites, plug-ins or applications that allow third parties to collect or share your personal data. We have no control over the processing activities of these third party websites, and so when you leave our website, please read the privacy notice of every website you visit.

We use your personal data for the purposes set out above. This might mean that we have to share your personal data with third parties, including:

The LTA – to whom we share information to assist with investigations involving our services, and to whom we send lost property left on our buses;

insurance companies in relation to incidents involving our buses.;

our professional advisers, such as our auditors and solicitors.;

if we choose to restructure our business we may share your personal data with third parties who we choose to sell, transfer or merge parts of our business and assets with, or who we seek to acquire or merge with. New owners of our business may use your personal data in the same way as set out in this Privacy Policy; and

other legal, regulatory, judicial and law-enforcement agencies who we may need to share personal data with to comply with our legal obligations.

These third parties are required to respect the security of your personal data and treat it in accordance with the law. They can only use your personal data in connection with the services we provide to you. We do not allow them to use your personal data for their own purposes unless it is incidental to the services they are providing to you on our request.

How long does Tower Transit process my personal data for?

Under data protection laws, we cannot retain your personal data in a form that identifies you for longer than is necessary to fulfil the purposes for which we collected it. This may include for the purposes of satisfying any legal, accounting or reporting requirements.

We usually store personal data for up to 7 years, but there may be occasions where we need to store it for longer or shorter periods. For example, we usually store CCTV and audio footage for 10 days or 240 hours unless it captures an incident that we investigate which involves a child, in which case we may keep this footage until they turn 21 years old. In order to determine how long we store your personal data for, we take into consideration why we need to continue to store your personal data, whether we can achieve the same result without having access to your data, and what the potential risk is if there is a data breach that affects your data.

Occasionally we may anonymise data which means that it is no longer associated with you. We do this for statistical or research purposes so we can improve the services we offer to you. We can use anonymous data indefinitely without further notice to you.

How does Tower Transit keep my personal data secure?

Once we have received your personal data we will use reasonable and necessary procedures and security features to try and prevent unauthorised access. For example, we limit access to personal data to those employees, agents, contractors and other third parties who have a business need to know. They are only allowed to process personal data in accordance with our instructions, they are required to keep all such data secure, and they are subject to a duty of confidentiality.

If we become aware of a data breach that affects personal data, we will notify the Information Commissioner’s Office. If we believe the data breach is serious, we may notify you in accordance with our legal requirements.

Who can I contact about Tower Transit’s processing of my personal data?

At Tower Transit we work hard to ensure that we process personal data in compliance with data protection laws. We know that sometimes you might want to ask questions about our processing activities and so please contact us by emailing PDPA@towertransit.sg

We reserve the right to update this policy to reflect any changes to the way in which we collect, process or share your personal data, or to reflect any legal requirements. When we make any changes, we will upload the new version to our website. The new version will take effect as soon as it is uploaded.